{
  "id": 17310143,
  "title": "Crim spent $7K+ on AI services in extortion attacks, then left evidence for all to see",
  "url": "https://urgent.news/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-17310143",
  "topic": "ai",
  "section": "AI",
  "published": "2026-10-30T19:37:12.000Z",
  "source": {
    "name": "The Register",
    "slug": "the-register",
    "url": "https://www.theregister.com/security/2026/10/30/crim-spent-7k-on-ai-services-in-extortion-attacks-then-left-evidence-for-all-to-see/5306754"
  },
  "original_language": "en",
  "account": "A non-ransomware group utilized a combination of artificial intelligence and conventional techniques to infiltrate 23 organizations across 14 countries. The perpetrators, identified as \"n0n,\" failed to exploit any vulnerabilities and instead relied on weak or stolen credentials for access. Their tools included AI-assisted development, remote desktop protocol scanning, and stolen AWS access keys. Using this key, they accessed and deleted data from 40 S3 buckets, including bank transaction archives. Despite the hype around AI-driven attacks, n0n did not exploit a single bug to gain entry. The group left behind evidence of their operations, including an AI coding agent environment and 1,719 files across multiple snapshots, such as attack scripts, ransomware source code, and extortion infrastructure. n0n claimed 108 victims since its emergence, with ransom demands ranging from $400,000 to $28 million. However, none of the 38 maritime firms targeted by the group paid the ransom by the deadline, and the stolen data was ultimately published on their leak site.",
  "summary": "n0n-existent security",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}